Reducing barriers to accessing administrative data on SARS-CoV-2 vaccination for research

KEY POINTS

• Substantial challenges in securing timely access to individual-level data on SARS-CoV-2 vaccination from provincial ministries of health have limited researchers’ ability to inform Canada’s pandemic response with Canadian evidence.

• Legislation governing provincial personal health information includes provisions for linkage to administrative health data with a waiver of consent, and most provincial legislation does not preclude interprovincial sharing of patient-level data.

• Provincial patient-level data on SARS-CoV-2 vaccination should be shared in a timely manner with a waiver of consent to expedite the publication of vaccine safety, effectiveness and epidemiological research that can improve public health and clinical decision-making.

• Partnerships between provincial health data custodians and Health Data Research Network Canada can facilitate timely sharing of data for research while ensuring the security of patients’ personal health information.

Public trust in scientific research, especially research regarding vaccines, has proven fragile during the COVID-19 pandemic. To counter abundant misinformation about SARS-CoV-2 vaccines, rigorous, ongoing evaluations of vaccine safety and effectiveness by independent Canadian researchers are important.¹ However, researchers’ efforts to conduct timely, national studies of vaccine effectiveness have been hindered by barriers to data sharing that have made it difficult to integrate patients’ vaccination status into SARS-CoV-2 clinical and epidemiological studies.²

After the SARS outbreak in 2003, an independent commission in Ontario recommended that data custodians develop mechanisms to fast-track access to administrative health data as a means of facilitating research that could guide pandemic responses.³ Unfortunately, this recommendation has not been followed during the COVID-19 pandemic, which continues to undermine the pandemic response in Canada. We discuss how a risk-averse data-sharing culture has led to missed opportunities to conduct robust, timely, pan-Canadian SARS-CoV-2 clinical and vaccine effectiveness studies, and we outline mechanisms for data sharing that can and should be undertaken.

How can linking patient-level administrative vaccine data to clinical research data generate timely evidence?

The advantage of large-scale linkages of health care data has been shown in studies of vaccine effectiveness and safety from other countries. England has employed a vaccination registry and facilitated legally authorized data sharing among health data custodians to enable the rapid generation of postmarketing vaccine effectiveness and safety data.^4–6 Scotland developed the EAVE II national registry, which links data from multiple national databases to enable timely evaluation of COVID-19 risk stratification and vaccine effectiveness across Scotland.^7,8 Denmark created a national COVID-19 registry to facilitate observational studies, including studies of the effectiveness of novel combined vaccine schedules against emerging variants.⁹ The Israeli Ministry of Health created a central data repository of all COVID-19 data, which are transferred to the country’s health care delivery organizations, allowing for robust and timely analysis of vaccine effectiveness.^10,11 These initiatives have facilitated rapid completion of vaccine effectiveness studies in these jurisdictions.

In Canada, researchers affiliated with provincial data custodians have conducted studies of SARS-CoV-2 vaccine effectiveness using provincial administrative data.^12,13 However, providing independent researchers with timely access to patient-level vaccination data from across Canada, and enabling linkages to existing national clinical data sets, would allow for adequate sample sizes to be achieved substantially faster. Linkage of patient-level vaccination data to clinical data sets would enable quantification of vaccine effectiveness in populations that were excluded from preapproval clinical trials, including marginalized, underhoused, pregnant and immunosuppressed patients who can be accurately identified in clinical registries. Robust COVID-19 clinical data sets, with linkages to patient-level administrative data on vaccination, could be leveraged as clinical trial platforms to prospectively evaluate the safety and effectiveness of vaccines and novel COVID-19 therapies. Without linkage to provincially held, patient-level vaccination data, the utility of carefully collected national COVID-19 clinical data sets is substantially constrained.

How has the absence of data-sharing infrastructure in Canada impeded research?

Rapid access to administrative data and interprovincial data sharing have been identified as important components to a robust, national pandemic research response.¹⁴ The absence of a coordinated, pan-Canadian, secure research environment for interprovincial data linkage and analysis has been highlighted as a shortcoming in Canadian research infrastructure that has limited the timeliness of Canadian research, both before and during the pandemic.^14,15

Our recent research experience provides an example of the existing challenges in data access for researchers who are not affiliated with provincial data custodians. The Canadian COVID-19 Emergency Department Rapid Response Network (CCEDRRN) has developed a registry with data from more than 180 000 patients tested for SARS-CoV-2 in emergency departments across 8 provinces (Appendix 1, available at www.cmaj.ca/lookup/doi/10.1503/cmaj.211712/tab-related-content).¹⁶ Data collection and linkage to administrative data were approved with a waiver of informed consent after robust evaluation by 30 institutional research ethics boards (REBs). Each participating site transfers deidentified, patient-level data to the coordinating centre, located at the University of British Columbia, for analysis on a secure research server. The network has used these data to develop risk prediction tools to estimate the probability that a symptomatic patient in the emergency department would test positive for SARS-CoV-2, and the probability that a patient with COVID-19 would have an adverse outcome.^16–18 The network has funding from the Canadian Immunization Task Force and the Canadian Institutes of Health Research to conduct postmarketing studies of vaccine effectiveness (including in populations who were excluded from premarketing randomized trials), to identify risk factors for development of post-COVID-19 conditions and to update existing risk scores to account for vaccination status.

This work requires linkage of CCEDRRN data to patient-level administrative data on vaccination. However, provincial data custodians have been hesitant to provide CCEDRRN researchers with the necessary vaccination data. To date, British Columbia and Nova Scotia are the only provinces that have agreed to link vaccination data with CCEDRRN. Vaccination data linkage is still under negotiation in Alberta, New Brunswick and Quebec, with various explanations for delays, including limited resources to process data-sharing agreements and transfer data in a timely fashion. Provincial data custodians have also cited barriers related to provincial privacy legislation or to policy that they say precludes sharing patient-level data with researchers. Three provinces (Manitoba, Ontario and Saskatchewan) have declined to share data with CCEDRRN. Although CCEDRRN has REB approval from Clinical Trials Ontario to conduct data linkage with a waiver of patient consent, the Ministry of Health for Ontario has refused to share vaccination data without prospective patient consent. Given that CCEDRRN’s REB-approved methods include a waiver of consent for administrative data linkage and more than 180 000 patients have been recruited over 2 years, it is not pragmatically possible for the network to fulfil this requirement.

Are provincial privacy laws a barrier to sharing vaccine data for research purposes?

Every province in Canada has legislation governing personal health information (Appendix 2, available at www.cmaj.ca/lookup/doi/10.1503/cmaj.211712/tab-related-content). These laws allow administrative health care data — including personal health information — to be used for research purposes (Table 1). Different conditions for data disclosure to researchers apply in each province. All provinces (except BC) require that the research in question be approved by an REB before data can be disclosed to a researcher. In BC, this requirement exists in policy, not in legislation.¹⁹ Other common legal conditions for disclosure of data for research under a waiver of informed consent include that the research serves the public interest, that seeking consent is not feasible (or that the research is otherwise not feasible if consent were required) and that the disclosure poses only minimal risk.^20,21

Table 1:

Comparison of provincial legislation pertaining to personal health information^*

Characteristic	British Columbia	Alberta	Saskatchewan	Manitoba	Ontario	Quebec	New Brunswick	Nova Scotia	Prince Edward Island	Newfoundland and Labrator
Is research with PHI permitted, in principle?	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Is approval by an REB required before PHI can be shared for research purposes?	No‡	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Is consent from individuals needed before PHI can be shared for research purposes?†	No	No	No	No	No	No	No	No	No	No
Must PHI be shared with researchers if legislative conditions (e.g., REB approval) are met?	No	No	No	No	No	No	No	No	No	No
Can a provincial CMO compel disclosure of PHI for research purposes?	No	No	No	No	Yes	No	No	Yes	No	No
Does PHI legislation trump other laws, including provincial public health legislation?	Yes	Yes§	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes

Note: CMO = Chief Medical Officer, PHI = personal health information, REB = research ethics board.

^*This table is derived from a legal analysis of applicable provincial laws and regulations, as well as searches of court decisions, outlined in Appendix 2.

^†In all provinces except Saskatchewan, PHI may be used for research purposes without the consent of individuals who supplied the PHI in question. However, an REB may stipulate that such consent is necessary. In Alberta, this is expressly noted in the legislation governing the collection, use, and disclosure of PHI.

^‡In British Columbia, provided the Minister has granted an order for a “health information bank” to conduct research, the bank in question may collect or use PHI for research purposes without prior approval by an REB.

^§Under Alberta law, PHI legislation prevails over other Alberta laws unless there is an express indication to the contrary. The province’s Public Health Act contains no such provision stating it prevails over the PHI legislation. Therefore, the fact that there is no power under the Public Health Act that enables the CMO to share PHI with researchers does not undermine the authority that the CMO possesses under PHI legislation to disclose such information for research purposes.

Despite provincial data custodians raising the concern that sharing deidentified patient-level data across provincial borders is not lawful, interprovincial data sharing is both possible and encouraged. Laws governing personal health information explicitly permit such sharing provided certain conditions are met, including REB review and approval of the proposed research (Table 1). Moreover, in 2 provinces (Ontario and Nova Scotia), public health officials are empowered to compel the collection and disclosure of personal health information to researchers in the context of a public health emergency such as COVID-19 (Table 1 and Appendix 2). Given this legal landscape, data custodians should seek opportunities to share data during a pandemic, rather than deny requests.

Lack of clarity exists around which provincial legislation governs specific data. As provincial custodians have been capturing SARS-CoV-2 data during the pandemic, some consider that these data are governed by provincial public health acts rather than provincial legislation on personal health information. Many provincial public health acts do not explicitly discuss disclosure of patient-level data for research purposes. However, with the exception of Saskatchewan (where legislation does not clarify which law trumps in the event of an inconsistency), all other provinces’ legislation on personal health information contains clauses stating they supersede other legislation in the absence of an explicit provision to the contrary in another piece of legislation (Table 1). Given that provincial public health acts lack provisions that explicitly trump laws on personal health information, then laws on personal health information provide sufficient legal authorization for disclosure of patient-level data on SARS-CoV-2 vaccination with a waiver of consent to researchers for REB-approved studies.

Health Data Research Network (HDRN, https//www.hdrn.ca) is a federally funded, nonprofit, pan-Canadian organization that facilitates data-sharing partnerships between health data custodians and researchers. Its privacy team concluded that, in most cases, sharing of SARS-CoV-2 data (including interprovincial transfer of data for research) can be supported within current legislative structures.²² This conclusion suggests that data custodians’ concerns that provincial legislation prohibits disclosure of administrative health data, including sharing data across provincial borders, to researchers who have received REB approval for their work, are not based on correct interpretation of provincial law. Moreover, the expert advisory group of the Pan-Canadian Health Data Strategy stated that misinterpretation of provincial and territorial privacy law “provides incentives to some custodians to act in a risk-averse manner that restricts access to authorized individuals and stifles clinical care, decision support and research.”²

Custodians’ desire to protect the privacy of patient information contained in administrative data holdings is consistent with their obligations to patients. However, the minimal risk associated with disclosure of patient-level administrative data to researchers using highly secured data transfer protocols and digital environments is reasonable in relation to the importance of the knowledge to be gained. Risk-averse decision-making by custodians hinders researchers’ ability to generate scientific evidence that serves the public interest.

What could improve sharing of data on SARS-CoV-2 vaccination?

One approach to facilitating access to or linkage of national vaccination data in Canada is for provincial data custodians to partner with HDRN and its member data centres to enable a similar linkage strategy as can be achieved with the Canadian Institute for Health Information. These agreements would allow patient-level administrative vaccination data to be held in HDRN member data centres, facilitating timely transfer of data to researchers while maintaining custodians’ data sovereignty, and reducing administrative burdens for data custodians and researchers. Partnerships between provincial data custodians and HDRN would also harmonize and standardize administrative data on vaccination and access for all researchers. Currently, data on SARS-CoV-2 vaccination from Manitoba, Newfoundland and Labrador, and Ontario²³ are available through HDRN, but access is restricted to aggregate, provincial-level data. Partnerships between HDRN and data custodians across Canada are needed to facilitate pan-Canadian research on the effectiveness of SARS-CoV-2 vaccines and epidemiological research.

Until these partnerships exist, it is incumbent upon provincial ministries of health to ensure that their data management teams are sufficiently resourced to complete data-sharing agreements and data transfers to researchers in a timely fashion. Provided that the research is in the public interest and adheres to research ethics guidelines, and researchers have mitigated the risk to confidentiality of the personal health information being disclosed, provincial custodians should exercise their authority to share patient-level administrative health data with waiver of consent, and do so expeditiously.

Another option, of lesser utility, is to request access to vaccination data through Health Canada. In 2019, it became mandatory for provincial health care institutions to report serious adverse drug reactions, which includes adverse reactions to vaccines that are not part of a routine immunization program, directly to Health Canada. Therefore, Health Canada should have safety-related vaccine data that may be of use to independent researchers.²⁴ Health Canada is empowered by law to share such data for the purposes of protecting health or public safety provided that the researchers protect patient privacy through the very measures required to secure REB approval.²⁵ However, the extent to which health care institutions have been reporting safety data to Health Canada remains unknown. Moreover, these data would likely be of value only for vaccine safety studies.

Conclusion

Timely, national-level research addressing evidence gaps in SARS-CoV-2 vaccine effectiveness, safety and impact on clinical care is important for guiding public health and clinical decision-making. Making administrative data available to independent researchers presents an important opportunity to validate the effectiveness data for vaccines and build public trust in Canada’s public health and vaccination strategy. Provincial data custodians should work to enable timely sharing of patient-level vaccination data with REB-approved research projects to facilitate these objectives, given that sharing such data is legally permissible.